[Iheanacho-ai]

What

Updates the SecureBoot imager output examples for v1.14 and v1.15 so they match what the imager prints today.

Why

Both examples showed lockdown=confidentiality on the kernel command line. Talos dropped that default in 1.14.0 (siderolabs/talos@35c8f172c), so SecureBoot images now run with lockdown=integrity implicitly. The examples were also from a much older Talos: they had an installer-base:v1.5.0-alpha.3-…-dirty image reference, the old signing-key layout (signingKeyPath, pcrPublicKeyPath), and old kernel arguments.

Change

• Replaced the secureboot-iso and secureboot-installer output on the v1.14 and v1.15 SecureBoot pages with the real output of the commands on each page. The examples now show:
  • the secureBootSigner and pcrSigner key layout
  • isoOptions (ISO example)
  • the current kernel command line, without lockdown=confidentiality
  • the current installer-base tag
• The version is written as ${release_v1_14} and ${release_v1_15}.
• Split the four $ prompt-and-output code blocks on each page into a command block and an output block, as the style check requires. The same split is in the talos-secureboot-kexec branch, so the two don't conflict.

Testing

• Ran: Checked the Talos source. lockdown=confidentiality is added only for Talos versions below 1.14.0 (ForcesLockdownConfidentiality in pkg/machinery/imager/quirks/quirks.go, called from SecureBootArgs in pkg/machinery/kernel/kernel.go). The threshold is the same in v1.14.0, v1.14.5, and v1.15.0-beta.0.
• Ran: Generated test SecureBoot keys with talosctl v1.15.0-beta.0 (gen secureboot uki, pcr, database), then ran both page commands with the amd64 imager:v1.15.0-beta.0 and imager:v1.14.5. All four runs succeeded. The examples are their output, leaving out only the progress spinner lines.
• Ran: make style-check-changed-local (0 errors) and make canonical-links-check. Neither page has any lockdown, pcr-signing-public-key, or init_on_alloc left.
• Where: Locally, with the amd64 imager images under emulation.
• By: An agent (Claude Code), reviewed by me.
• Filled from outside the page: Nothing. The talosctl get securitystate example on these pages still shows only the SECUREBOOT column, while Talos 1.15 has more columns. It's left for a follow-up, because its real output needs a SecureBoot machine.

[mintlify]

Preview approval required

This pull request comes from a fork, so Mintlify won't build a preview until someone with write access approves commit bb20b37.

Approve preview

[github-actions]

📋 Automated documentation review

An automated pass runs on documentation changes in every PR. The items below are suggestions to consider — advisory, not a merge gate.

Reviewed commit bb20b37 · 🔴 0 critical · 🟡 0 warning(s) · ⚪ 1 notice(s)

Nothing flagged at critical or warning level — see any notices inline.

Notices, and the reviewer's full report, are in the run's doc-accuracy-report artifact.